Grafana

What is Grafana?

Grafana is an open-source platform for data visualisation, monitoring and observability that queries dozens of kinds of data sources and presents the results as dashboards, charts and alerts, without storing the process data itself. It was first released in January 2014 by Swedish developer Torkel Ödegaard and has since been developed by Grafana Labs. Within Industrial Automation and OT environments, Grafana has become a widely used visualisation layer for process trends, energy consumption, machine performance, network status and Cybersecurity events. That makes it a familiar building block in modern IT OT Convergence architectures: the same tool the IT team uses for server and application Monitoring also shows data from the industrial network. Thanks to that Scalability, Grafana fits on a small edge server as well as in a central platform covering dozens of sites.

🧠 How does Grafana work?

Grafana is a web application with a backend written in Go and a frontend in TypeScript/React. It is not a database: every time a dashboard is shown, it sends a query to a data source and draws the result. The Architecture has four layers:

1. Data sources - a Time Series Database such as InfluxDB or TimescaleDB, Prometheus, an SQL database or a Historian.
2. Data source plugins - connectors that speak each source’s query language (InfluxQL/Flux/SQL, PromQL, LogQL).
3. Dashboards and panels - line charts, gauges, heatmaps, tables, state timelines and maps.
4. Grafana Alerting - rules that evaluate queries periodically and send notifications through contact points.

Grafana only keeps its own configuration (users, dashboards, alert rules) in an internal database. By default this is an embedded SQLite database; for production and high availability Grafana Labs recommends MySQL 8.0+ or PostgreSQL 12+. The minimum requirements are modest: Grafana Labs cites 512 MB of memory and one CPU core as the lower limit, so it also runs on a modest edge server or industrial PC. Most of the computing load sits in the data sources that execute the queries.

Which editions are there?

The 2021 switch to AGPLv3 matters to vendors that ship a modified Grafana inside a product or offer it as a service; for end users running it internally, little changes in practice.

🏭 What is Grafana used for in industrial automation?

In OT, Grafana is mainly used as a complementary analysis layer alongside SCADA and the HMI. Typical applications:

• Process monitoring - temperature, pressure, flow and level as trends over hours to months.
• Machine monitoring - cycle times, motor load, downtime causes and OEE per line.
• Condition Monitoring and Predictive Maintenance - vibration levels, bearing temperatures and current draw against thresholds or trends.
• Energy monitoring - kWh, gas consumption and peak demand per installation, for example as input for an energy management system under ISO 50001.
• OT Network Monitoring - switch ports, Bandwidth, Latency and Jitter via SNMP or flow data.
• Security Monitoring - events from Syslog, IDS and Firewall alongside a SIEM, supporting Threat Hunting and Incident Response.

A typical example: a food manufacturer shows on one screen the OEE of three lines, the cold store temperatures and current electricity consumption, with data from three different sources. That is exactly what a traditional SCADA HMI makes awkward and where Grafana excels.

🔧 How does OT data get into Grafana?

Grafana almost never talks to a PLC directly. Industrial protocols such as Modbus TCP, ProfiNET, Ethernet IP and OPC UA are first read by a collector or gateway and written to a database. Common pipelines:

InfluxData’s Telegraf agent has input plugins for OPC UA (client and listener), Modbus, MQTT and SNMP, among others. Grafana Labs’ MQTT data source streams messages straight into a dashboard but stores nothing itself: historical trends still need a database.

Within the Automation Pyramid and the Purdue Model, Grafana therefore usually sits at level 3 (site operations) or in the DMZ, above the sensors, PLCs and the DCS, and next to MES functions. Data flows upwards; Grafana sends nothing back to the process.

🔄 What is the difference between Grafana and SCADA?

Grafana therefore does not replace SCADA or an Alarm Management system following ISA-18.2. Grafana alerts are intended for trends, condition monitoring and IT-style supervision, not for operator alarms that require immediate action. For process graphics the principles of ISA-101 still apply; for analysis and management dashboards Grafana offers far more freedom. When choosing an industrial platform, Grafana is often compared with Ignition, which does provide HMI/SCADA functionality with write access.

🔐 How do you secure Grafana in an OT environment?

From a Security point of view Grafana is an attractive target: it often has read access to sensitive process data and frequently runs with overly permissive defaults. Two vulnerabilities show why Hardening is necessary:

• CVE-2021-43798 - a path traversal in the plugin route (/public/plugins/<id>/) that let an unauthenticated attacker read arbitrary files, such as grafana.ini and the configuration database. Affected: 8.0.0-beta1 up to and including 8.3.0, fixed in 8.0.7, 8.1.8, 8.2.7 and 8.3.1. CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 9 October 2025.
• CVE-2025-4123 (“Grafana Ghost”) - an XSS via an open redirect (CVSS 7.6) that works without editor rights when anonymous access is enabled. The patch appeared in May 2025, yet a scan in June 2025 found that more than a third (around 36%) of internet-facing Grafana instances still ran a vulnerable version.

Key controls:

The plugin ecosystem deserves extra attention. Since Grafana 12, AngularJS plugins are no longer loaded; old community panels that depend on them break on upgrade. Include plugins in the lifecycle management and governance of the OT Architecture. For organisations within the scope of NIS2 and the Dutch Cybersecurity Act, a monitoring platform such as Grafana belongs in the asset inventory and vulnerability management, just like any other system with access to OT data.

📋 How do you set up Grafana for OT monitoring?

A practical approach for, say, a production site or a water board with dispersed pumping stations:

1. Define the purpose - which questions should the dashboard answer (OEE, energy, condition)? Start with five to ten core KPIs rather than hundreds of tags.
2. Choose the data source - reuse an existing historian or set up a time series database. Agree on retention up front, for example raw data for 30-90 days and aggregated data for several years.
3. Place the collector close to the source - a Telegraf or Node-RED instance on an edge server that only reads and writes to the DMZ over a fixed route.
4. Install Grafana in the DMZ - as a container (Docker or Kubernetes) or as a service, with PostgreSQL or MySQL as the configuration database once more than one instance is needed.
5. Set up access - connect to the central identity source, use folders per department and give operators Viewer rights only.
6. Design with restraint - keep refresh at 10-30 seconds for management dashboards, limit the number of series per panel and watch out for high label cardinality.
7. Manage as code - keep dashboards and alert rules under version control (provisioning), so changes are traceable and a reinstall is quick.

Edge, on-premise or cloud?

For Critical Infrastructure and strongly segmented production environments, an on-premise installation is the norm. With Edge Computing, a lightweight Grafana instance runs locally on a line or pumping station, so dashboards keep working when the WAN link drops. A Cloud deployment is mainly useful for multi-site benchmarking as part of Industry 4.0; send aggregated data over an outbound connection from the DMZ so that no inbound traffic to OT is needed.

With this setup Grafana remains a secure, read-only layer that shows IT and OT teams the same data, without anyone being able to influence the process through a dashboard.

❓ Frequently asked questions

Is Grafana free?

Grafana OSS is free and open source under the AGPLv3 licence and can run without limits on your own servers. Grafana Labs also sells Grafana Enterprise, with extra features and support, and offers Grafana Cloud as a SaaS service with a free entry tier.

Does Grafana store data itself?

Grafana does not store measurements, only configuration such as dashboards, users and alert rules. The process data stays in the data source, for example InfluxDB, TimescaleDB, Prometheus or a historian. If you want to keep trends, you always need a separate database alongside Grafana.

Can Grafana read a PLC directly?

Grafana normally does not read a PLC directly, because it does not speak fieldbus or industrial Ethernet protocols. A collector such as Telegraf or Node-RED, an OPC UA gateway or a historian fetches the data and writes it to a database. Grafana then displays the data from that database.

Can Grafana replace SCADA?

Grafana cannot replace SCADA, because it offers no operation, no setpoints and no full operator alarm system. Grafana is a read-only analysis and visualisation layer that runs alongside SCADA. Its strength lies in combining data from multiple sources and showing long-term trends.

What is the LGTM stack?

The LGTM stack is Grafana Labs’ observability combination: Loki for logs, Grafana for visualisation, Tempo for traces and Mimir for metrics. In OT environments often only part of it is used, for example Grafana with Loki to search syslog messages from switches and firewalls centrally.

Which port does Grafana use?

Grafana listens on TCP port 3000 by default over unencrypted HTTP, with admin/admin as the default login on first start. In an OT environment Grafana should sit behind a reverse proxy with TLS, and the default password must be changed immediately.

📌 In summary

Grafana is an open-source, read-only visualisation and observability layer that brings OT and IT data from historians, time series databases and log sources together in one set of dashboards and alerts. In industrial environments Grafana sits alongside SCADA, not in place of it: data arrives through collectors such as Telegraf or Node-RED, Grafana is best placed in the DMZ, and firm controls around authentication, TLS, patching and plugin management are needed, as CVE-2021-43798 and CVE-2025-4123 show.